The IRS says it protected approximately $38 billion in tax revenue from identity theft refund fraud in fiscal year 2026, a figure the agency put in an Oct. 29 year-end performance release. The same release says the total dollar amount of refunds claimed rose 17 percent over last year. The number is the agency’s own, and the release does not explain how it was calculated.
IRS Chief Executive Officer Frank J. Bisignano called it a successful filing season and said the agency is working to “transform the IRS into a Digital-First agency.” The release credits the Security Summit, the partnership of the IRS, state tax agencies and the tax industry, for detecting and stopping fraudulent returns.
What did the filing season look like behind the $38 billion?
Refunds grew in both size and speed. The IRS says the average refund rose 11 percent, about 90 percent of electronic filers received a refund in less than 21 days, and direct deposit refunds were 12 percent higher than last year. Collections for fiscal 2026 hit a record $5.6 trillion, up nearly 5 percent.
The agency also says people leaned on its online tools. Payments through individual online accounts rose 57 percent to more than $133.6 billion, about 37.6 million people used an individual online account, and the Where’s My Refund tool logged nearly 469 million status checks.
Who is left holding the risk when a return is filed in someone’s name?
The release says nothing about how many fraudulent returns got through, how many honest filers had refunds held up, or how many people learned a return had already been filed under their Social Security number. Those are the numbers that matter to a retiree who files every year and expects a refund to arrive.
Retirement deadlines, in your inbox: Miss an enrollment or claim deadline and the money can be gone. Join the Retirement Money Brief and we’ll send you our 2026 Government Check Reality Tracker as a welcome gift.
Get the Brief + the check tracker →
We may earn a commission from links on this page.
The IRS has said before that its fraud defenses work, though those figures come from earlier years. A Security Summit page on how the agency protects taxpayers, last reviewed in May 2025, reported that the IRS protected a combined $26 billion in fraudulent refunds between 2015 and 2019 and that taxpayers reporting identity theft victimization fell 80 percent.
How can a taxpayer lock a Social Security number against a fake return?
The tool the IRS points to is the Identity Protection PIN. The agency’s own description of it, on a page about how it protects taxpayers, is a six-digit number known only to the taxpayer and the IRS. Anyone with a Social Security number or taxpayer identification number who can verify their identity can enroll, and parents or guardians can request one for a dependent.
The fastest route is the IP PIN section of an IRS online account, which requires registering and validating identity first. Anyone who cannot enroll online can file Form 15227 if the adjusted gross income on the last filed return was below $84,000 for an individual or below $168,000 for a married couple filing jointly. The IRS calls the phone number given on the form to verify identity, and the PIN arrives by mail, usually within four to six weeks.
A third path is an appointment at a Taxpayer Assistance Center with one federal or state photo ID and a second form of identification, with the PIN usually arriving by mail within three weeks.
Does the PIN stay the same from year to year?
No. A new IP PIN is generated each year and is valid for one calendar year. People who enrolled online have to retrieve the new number from their account, because the IRS does not mail a notice to them. Confirmed identity theft victims, by contrast, receive a CP01A notice with their new PIN.
Because the number changes, a PIN saved from the prior year is out of date, and online enrollees have to pull the new one from their account before they file.
Is your Social Security number still open to a fake return?
The $38 billion is the IRS describing what it stopped, and the agency has not said how many fraudulent returns were filed in someone’s name or how many people had to prove who they were afterward. For a retiree who files every year and counts on the refund, a return filed first by someone else is the problem the PIN is meant to stop.
“Scam-Proof Your Accounts in a Weekend” is a 13-page guide of ten moves in weekend order, including how to get an IRS Identity Protection PIN so no one can file a return in your name and how to freeze your credit at all three bureaus, free by federal law. It also holds a first-hour plan for anyone whose accounts are hit anyway.
Get the IRS Identity Protection PIN steps and the credit freeze guide →
This article was produced with AI assistance and edited for accuracy against the sources linked above.
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
